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(54) Implantable cardiac stimulation device 

(57) The present invention provides an implantable 
device that assists the human heart, having airtomaticity 
functions in each of two different sets of microprocessor 
operating code. Following implantation, telemetry is uti- 
lized to place the device in a first, normal mode of oper- 
ation in which it executes the first set of operating code, 
stored primarily in RAM, and performs parity and check- 
sum software error delect ion. Upon detection of an er- 



ror, the microprocessor is caused to enter a second, 
backup mode of operation where it executes the second 
set of operating code, which is retained in read-only 
memory. Thus, in the event ol error detection, the im- 
plantable device is still fully functional in its backup 
mode to provide automaticity. The device also includes 
a watchdog circuit, which constantly monitors the micro- 
processor to detect a hardware error, triggering fixed- 
rate pacing if it is detected. 
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Description 

This invention relates generally to implantable devices such as heart pacemakers and, more particularly, to an 
implantable device that provides automaticity in at least two operating modes, including at least one software backup 
s mode. 

Improper operation of the heart can often be remedied by the use of an implantable device, e.g., a pacemaker. 
These devices generally provide an electrical pulse to a selected area of the heart that is not (In terms of timing or in 
terms of strength) properly receiving its natural pulse. Using implantable devices, physicians have been able to provide 
electronic assistance for many different disorders, including pathological bradycardia (abnormal, slow heartbeat), taen- 
ia yarrhythmia (abnormal, fast heartbeat), and other conditions that can, over time, pose a threat to a patient's life. 

Implantable devices generally include three basic elements, i.e., one or more electrodes, a corresponding number 
of insulated leads, and a control unit. 

The one or more electrodes are used to provide electrical stimuli directly to the heart muscle. These stimuli can 
be pacing pulses, and sometimes can include relatively larger shocks, such as are used to break up tachyarrhythmias. 
15 The electrodes are generally threaded directly into the heart muscle and they also can be used to electrically sense 
heartbeat. In addition to these electrodes, other electrical sensors may be used by the device to sense blood gases, 
respiration, cardiovolume, temperature, pressure or other physiological conditions. 

The insulated leads are used to connect these electrodes with the control unit. The control unit is a relatively large 
object, and thus must be placed within the chest cavity but away from the heart. The insulated leads are laid within the 
20 chest during surgical implantation, and are also used to connect the control unit to the various other sensors, for 
example, pulmonary sensors at the lungs. 

Finally, the control unit includes electrical circuits that generate the pacing pulses from one or more batteries. 
Modern day devices are sophisticated and include control logic, timing circuits, and input/output ("I/O") circuitry that 
interfaces the control logic with the electrodes and/or other sensors. For example, the I/O circuitry provides analog-to- 
25 digital and digital-to-analog conversion, and it generates the desired electrical stimu li as pulses of the desired strength, 
duration and frequency. Modern control units typically include a microprocessor and memory, and also are configured 
to allow remote programming after implantation in the patient's body. 

Early pacemakers were fixed-rate devices, which provided electrical stimuli to the heart if it failed to beat within a 
predetermined time period. However, microprocessor-based technology has enabled implantable devices to make 
30 complex logical decisions based on a variety of physiological inputs. As examples, modem day implantable devices 
have the ability to distinguish different types of tachyarrhythmias and to select appropriate therapy that does not impose 
unneeded trauma on the heart. For example, for some patients, a heartbeat rate of 160 beats per minute might be 
considered abnormally fast, but it could be both improper and dangerous to associate that condition with a fibrillation 
condition, which can be treated by applying defibrillation shocks in excess of 500 volts. Such a heartbeat rate could 
35 be properly caused by physiological factors, such as stress or exercise. The present day microprocessor-based devices 
are capable of distinguishing normal physiological conditions from pathological conditions and also of selecling between 
alternative therapies for the latter. Logical decisions based on physiological variables, choice of therapies responsive 
to different heart conditions, and automatic self-configuration are examples of what is referred to as automaticity. For 
specific examples of automaticity, reference is made to a copending and commonly assigned U.S. Patent Application 
to No. 08/124,902, filed in the names of Lisa P. Weinberg and Samuel M. Katz on September 21, 1993, and entitled 
"Automatic Implantable Pulso Generator." That application is incorporated by reference, as though fully set forth herein. 

The microprocessor-based implantable devices have proven to be of great practical utility, because they do not 
impose unneeded trauma on the heart and provide therapy only as needed. However, these devices do occasionally 
suffer from malfunction and error, albeit this is infrequent and occurs no more frequently than with other modem elec- 
ts tronic or microprocessor-basBd devices. Unfortunately, however, malfunction or error is of significantly greater concern 
in an implantable device, because a person's life may depend on the device's proper operation. In these devices, errors 
could be caused by a malfunction in the hardware (the electronics) or by deterioration in the software, which might 
occur over time. 

To minimize the possibility of these errors, many modern implantable devices are provided with fixed-rate circuits 
so implemented in hardware, for use as a backup circuit instead of the microprocessor. These fixed-rate circuits are 
triggered upon detection of parity error, and they disable all of the programmable functions of the device, which simply 
becomes a fixed-rate pacemaker. In other words, in response to detected error, these implantable devices presume 
that their decision-making circuits are in error and revert to providing a periodic pulses to the heart, losing any auto- 
maticity functions that they might have had. Often, the microprocessor is completely shut-down to conserve power, or 
55 its operation is ignored and presumed by the circuit to be faulty. An audible alarm within the pulse generator is sometimes 
sounded, to indicate that the patient should return to a physician's office* 

However, under circumstances of software error, it is considered a waste of resources and dangerous to shut- 
down all of the device's automaticity functions and instead supply fixed-rate pacing to the heart, particularly because 
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the device mighl be used for tachyarrhythmia or bradycardia detection and therapy which cannot always be adequately 
treated by fixed-rate pacing. Otherwise stated, the very reason that the device was implanted in the patient in the first 
place might have been to address a condition that absolutely requires automaticity 

A further problem in using fixed-rate backup pacing is that the voltage provided to the heart might be set inappro- 

5 prlately high for the particular patient, and therefore might actually Interfere with the heart's normal operation. Unfor- 
tunately, in an observance of caution, that is exactly how some of today's programmable pacemakers operate. 

The fact that a software error has been detected does not necessarily mean that the microprocessor-based system 
is incapable of monitoring the heart's natural operation, of providing automaticity, or of diagnosing and handling po- 
tentially dangerous conditions, such as tachyarrhythmia and bradycardia. 

io Accordingly, there is a definite need for an implantable device that does not shut-down all control and automaticity 

functions upon detection of an error in operation. Further, there is a definite need to provide these devices with an 
alternative backup operation that does not impose unneeded trauma on the heart. Further, such a device should be 
capable of determining the extent of its detected malfunction and whether or not it can continue to operate, implementing 
fixed- rate pacing either not at all, or only as a last resort. The present invention, as described below, provides such a 

is device. 

The present invention provides an implantable device that meets the aforementioned needs. More particularly, the 
present invention provides an implantable device that can continue most of its normaf functions and operations, in- 
cluding automaticity notwithstanding detection of certain types of errors. The present invention provides a safer, more 
reliable implantable device that does not impose unneeded trauma upon the human heart. 

20 In accordance with one form of the invention, an implantable device includes a controller that determines the proper 

timing of electrical stimuli that should be provided to the heart, and that further includes two memory locations where 
it can store two sets of operational instructions and data. A first memory location, which can be a programmable, 
writable memory, is utilized to receive full -featured operating code that can be loaded at the factory or by telemetry. A 
second memory, which can be a read only storage, stores a second set of operating instructions, to thereby provide a 

25 backup that will be used for heart pacing and arrhythmia termination. This second set of code provides automaticity, 
and the system can switch to it in the event of a detected error in the first set of code. 

In a more particular form of the invention, the device can include two parallel memory address pointers, one pointing 
to RAM or to a combination of both RAM and ROM, and the other pointing just to ROM. These pointers, which can be 
two alternative vector tables, are respectively used in the normal and software backup operating modes. Alternatively, 

30 the second memory can contain compressed code, stored in ROM, that the microprocessor can decompress and load 
into RAM if a software error is delected. In a further particular feature of the invention, the microprocessor can presume 
hardware error in the event of a second error detection and only then fall back to fixed-rate pacing as a third, EVVI 
mode of operation. 

The device includes an error-detecting mechanism that can detect corruption of software used to generate the 

35 stimuli sent to the heart. This error-detecting mechanism can be anything that detects error in a microprocessor or 
computer circuit, for example, a parily error mechanism, a watchdog, a checksum mechanism, error correcting codes, 
a cyclical redundancy checksum, etc., or any combination of them. When a software error is detected, the controller 
does not shut down, but instead is directed to switch to pacing based upon the second, backup set of operating in- 
structions. The controilerthus still can respond to any desired number of physiological inputs, or can provide differing 

AO therapies, as determined by the code. The device continues to provide automaticity in this backup mode. 

In another form ol the invention, the device includes a digital circuit having a novel control structure. A first lovel 
of the control is provided by a telemetry circuit, which has the capability of placing the device in a first mode of operation, 
wherein the controller relies upon a first set of operating instructions and data. A second level of control is provided by 
a watchdog circuit, i.e., a circuit that ensures that the controller is operating properly by requiring it to periodically 

45 acknowledge its operation tothe watchdog circuit. If the controller fails to do so, the watchdog circuit presumes hardware 
error, freezes the controller, and implements a fixed-rate pacing circuit in a third mode of operation. Finally, the software 
error detecting mechanism provides a third level of control. It monitors the system's software and data being transferred 
in and out of the RAM for error. If it detects error, it causes the device to switch from the first mode and the first software 
set to a second mode of operation, where the controller relies upon second set of software, stored as a backup. If the 

so device is already in the second mode, it can inform the watchdog circuit, which then presumes hardware error and 
implements the fixed-rate pacing. Again, the device provides automaticity in at least two operating modes. 

The invention also extends to a method for controlling an implantable device to provide an electrical stimulus to 
the heart, the method using a controller, an error detecting mechanism and at least two areas of memory that each 
have a set of stored instructions that direct actions by the controller, the method comprising: 

55 

using a first set of the stored instructions to direct the actions of the controller in providing the stimulus to the heart, 

the first set of stored instructions providing at least one automaticity function; 

using the error detecting mechanism to detect error in operation of the implantable device; and 
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in response to the detection of error, using a second set ot the stored instructions to direct the actions of the 
controller in providing the stimulus to the heart, the second set of stored instructions also providing at least one 
automaticity function. 

s The invention may be carried into practice in various ways and some embodiments will now be described by way 

of example with reference to the accompanying drawings, in which: 

FIG. 1 illustrates the major functional blocks of the preferred implantable device, in terms of chip layout. In particular, 
four principal chips of the device include a controller chip, an I/O chip, a high voltage chip, and an external RAM chip. 
FIG. 2 is a software block diagram illustrating the various modes of the preferred embodiment and switching be- 
io tween these modes, in response to specified factors. 

FIG. 3 is a hardware block diagram ot the controller chip 13 of FIG. 1 . 

FIG. 4 is a hardware block diagram that illustrates the use of microprocessor-resets and error detection mecha- 
nisms of the present invention. FIG. 4 also illustrates the inter-relation of telemetry, error detection, and a watchdog 
circuit, and control over the preferred embodiment exercised by each of them. 
15 FIG. 5 is a hardware block diagram of the I/O chip 15 of FIG. 1 . 

FIG. 6 indicates functions associated with the various bits of a first control register, which is located at memory 
location 80B0 (hex) in the preferred embodiment. 

FIG. 7 indicates functions associated with the various bits of a second control register, which is located at memory 
location 8081 (hex) in the preferred embodiment. 
20 FIG. 8 indicates functions associated with the various bits of a first alarm control register (8060 hex). 

FIG. 9 indicates functions associated with the various bits of a second alarm control register (8061 hex). 

FIG. 10 indicates functions associated with the various bits of a third alarm control register (8062 hex). 

FIG. 11 is a software block diagram of anti-tachyarrhythmia functions used in the preferred implantable device. 

FIG. 1 shows the general layout of a control unit 11 of the preferred implantable device. As shown in FIG. 1, the 
25 control unit has four principal chips, including a controller chip 1 3, an input/output chip 15, a high-voltage chip 17, and 
an external randomaccess memory ("RAM") chip 18. The functions and inter-relation of these chips are briefly intro- 
duced as follows. 

The controller chip 1 3, shown at the left side of FIG. 1 , makes most of the device's logical decisions. To this effect, 
it includes a microprocessor 19 (e.g., the preferred "controller "), a telemetry circuit 21, other circuit elements including 

30 control registers and watchdog hardware 23, and an internal memory element 25 that stores a second set of operating 
code for the microprocessor, as will be explained below. Communications both between these elements and with the 
other circuits of the control unit 11 are sent via a system bus 26. 

The input/output ("I/O") chip 15 is shown at the upper right of FIG. 1 , and it provides input and output functions for 
the controller chip 1 3. In addition, the I/O chip also implements EVVI pacing in lieu of microprocessor-controlled pacing, 

35 in the unlikely event of a hardware error or a second software error. More particularly, the I/O chip 15 provides three 
circuit paths to the heart. First, monitoring logic 27 of the I/O chip receives sensory inputs from the heart or from other 
sensors, e.g., blood gas sensors and respiration sensors. In the preferred control unit 11, input signals coming only 
from the heart are used, and the microprocessor 1 9 relies upon heartbeat analysis of these input signals to distinguish 
physiological tachycardia from pathological tachycardia. 

40 The second and third paths to the heart are outputs from the control unit 11, and they are provided respectively 

by microprocessor-controlled pacing circuitry 29 and an EVVI state machine 31 . These elemonts directly control output 
logic 33, which is the hardware that actually generates the electrical stimuli for the heart. The microprocessor-controlled 
pacing circuitry is used by the microprocessor 1 9 to directly control the output logic using logic signals supplied by the 
microprocessor. In the case of microprocessor or hardware failure, the EVVI state machine 31 is conditioned to directly 

45 control the output logic, in accordance with hardwired values. The output logic thus always is used, whether it is re- 
ceiving its instructions from the microprocessor or the EVVI state machine, and it generates pulses in response to one 
or the other. 

The high-voltage chip 17. which is shown at the lower right of FIG. 1, is relied upon principally to provide anti- 
tachyarrhythmia therapy to the patient's heart. For example, a serious condition such as ventricular fibrillation ("VF") 

so can require large electrical shocks (e.g., several hundred votts) to arrest the VF condition and save the patient's life. 
The microprocessor 19 detects such a life-threatening condition and to responsively controls anti-tachyarrhythmia 
circuitry 35 of the high-voltage chip. However, this control is sophisticated, and it can vary substantially depending 
upon the particular condition detected by the microprocessor. The particular therapy applied is determined by one of 
two alternative sets of the microprocessor's operating code. The high voltage chip actually includes additional circuitry 

55 on the hybrid which is used for generating the high voltages used therapeutically. Whenever used in the specification, 
high voltage chip includes this additional circuitry. 

Less dangerous, but still significant, tachyarrhythmia conditions also can be diagnosed, and differing therapies 
are provided, depending upon the condition. For example, the microprocessor 19 can be programmed to cause the I/ 
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O chip 1 5 to apply relatively few, small (e.g., 1 0 vott) shocks to the heart if the heartbeat rate is detected to be above 
150 beats-per-minute ( U BPM"). Alternatively, a heartbeat rate detected to be above 260 BPM could be indicative of 
fibrillation and might call for stronger (e.g., 500 volt) and more numerous shocks, provided by the high-voltage chip 17. 
By diagnosing different conditions and providing therapy dedicated to different conditions, the prelerred implantable 

s device does not impose unneeded trauma to the heart by imposing larger shocks or more traumatic therapy when such 
is not needed. In addition, since the most significant life-saving function of the preferred device is to provide antltach- 
ycardla therapy, a second, backup microprocessor mode, discussed below, permits the microprocessor 1 9 to retain 
this vital function notwithstanding a delected software error. 

With initial reference to FIG. 2, the operation of the software of the preferred implantable device will be introduced. 

io The microprocessor 19 is provided with two alternative sets of software, each of which provides automaticity. The 
preferred device, in fact, provides three operating modes, which are diagrammaticalty indicated in four blocks of FIG. 
2, from bottom to top. A first, normal operating mode (the "RAM" mode, indicated in the bottom-most block) uses a 
first software set, while a second, backup operating mode (the "ROM" mode, shown in the middle of FIG. 2) uses a 
second, alternative set ol software. Finally, a third, frxed-rate ( n EWT) mode also is used. FIG. 2 actually shows this 

*s third mode in two blocks at the lop of FIG. 2; the third mode can be entered, as shown at the top left side of FIG. 2, in 
the event of detected hardware error or a second software error. As shown at the top right side of FIG. 2, the third 
mode also can be entered when telemetry is used to program the system and disable the logic functions, for system 
diagnosis and reprogramming. Automaticity functions, including the diagnosis and treatment of tachyarrhythmia and 
bradycardia, are provided in each of the first and second modes, whereas in the third mode, automaticity is not provided 

20 for, and fixed-rate pacing is provided under hardware control. The microprocessor is not used in the third mode. 

In the first mode (represented by the bottom-most block of FIG. 2), the microprocessor 1 9 operates on the first set 
of software, which is located primarily in the external RAM chip 18 of FIG. 1 . To access this set ol software or operating 
code, the microprocessor is supplied with a first memory address pointer (i.e., a first vector table) that directs the 
microprocessor to utilize the external RAM chip for most automaticity functions, and the internal memory element 25 

25 of FIG. 1 for certain functions common to both of the first and second modes, e.g., for software that causes the micro- 
processor to interface with the watchdog and control registers. 

In the second, backup mode (the middle block of FIG. 2), which is the default mode for the microprocessor 19 
when the implantable device is first implanted in a patient, the microprocessor operates upon the second set of software, 
which consists of operating instructions and data that are stored in the internal memory element 25 of the controller 

30 chip 13 of FIG. 1 . As will be explained below with reference to FIG. 3, this memory element includes an instruction set 
ROM 37, an internal workspace RAM 38, and a 64-byte vector ROM 40. The second set of operations code is stored 
in the instruction set ROM 37, whereas data and parameters can be loaded into the internal RAM 38. either by the 
second set of software or by telemetry. 

Like the first set of software, the second, alternate set of software also provides for automaticity functions, which 

35 can be the same functions provided tor by the first set of software, or a subset of them. The second set of software 
could provide different functions, and preferably is a factory standard set of three ant i -tachyarrhythmia therapies and 
one anti-bradycardia theiapy. In any event, the first and second modes both preferably rely upon some common soft- 
ware that is stored in the instruction set ROM 37, such as to interface with the control registers and watchdog hardware 
23 of FIG. 1 . After the implantable device has been initially implanted, it can be switched by telemetry to operate in the 

40 first mode. 

During operation of the implantable device in the first mode, an error dotocting mechanism is relied upon to cause 
the device to switch from the first mode to the second mode or the third mode. As indicated in FIG. 2. if the error 
detecting mechanism detects a software error when the device is operating in the first mode, the microprocessor tg 
is reset such that it begins operating in default, i.e., the second, backup mode, in the second mode, the microprocessor 

45 looks to a second vector table that points only to the internal memory element 25 of FIG. 1 . The microprocessor can 
still, in this mode, utilize the internal RAM for storing sensed parameters and variables, but its operating instructions 
are obtained only from the instruction set ROM 37, as commanded by the second vector table. 

As indicated at the left-hand side of FIG. 2, if a second software error is thereafter detected, or if a hardware error 
is' detected at any time, the error detecting mechanism causes the device to enter the third, EWI mode of operation. 

50 The device will thereafter supply only fixed-rate pacing until telemetry is used to take the device out of the third mode. 

With reference to FIG. 3, the controller chip 1 3 is shown to include several important logic elements that have been 
placed together on a single chip. Principal among these elements is the microprocessor 19, which is an 8-bit micro- 
processor that runs on a one megahertz clock. tt is supported by peripheral logic and several internal memory elements, 
including the instruction set ROM 37. the internal RAM 38, and the 64-byte vector ROM 40, which all are part of the 

& controller chip's internal memory element 25. In addition to these elements, the controller chip also features parity logic 
39, which checks the parity of parameters as they are retrieved from the internal RAM 38. The parity logic is one part 
of the error detecting mechanism used to switch the modes of the device according to the present invention. If the 
parity logic detects an error, it notifies a watchdog circuit 41 , which in turn causes the implantable device to enter the 
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second mode. 

The controller chip 13 also features additional logic elements that assist the operation of the device. For example, 
an audible alarm circuit 45 alerts the patient that the device requires attention, for example, when battery power is low, 
or that the high-voltage chip 17 is preparing to deliver a charge. The configuration ot the audible alarm circuit will be 
discussed further below. As with other microprocessor-based systems, the device includes interrupt logic 47, a system 
clock 49, reset logic 50, and real-time counters 51 , the latter being used to measure time periods as directed by soltware. 
Finally, the controller chip also includes a set of control registers 53 and 54, which provide various functions as illustrated 
by FIGS. 6 and 7 and, as will be discussed bebw. 

Read and write control of the various logic elements of the control unit 11 is provided to both the microprocessor 
19 and the telemetry circuit 21 , and to this effect, bus control logic 52 is employed to grant access to the system to 
these elements. The microprocessor and the telemetry circuit share the same system bus 26. but they do not share 
all of the bus control logic. The telemetry circuit has higher priority to use the system bus; hence, when telemetry is 
being used to access the bus, access by the microprocessor to the system bus is inhibited. 

The operating code for the first set of software for the microprocessor 19 is stored in the external RAM chip 18, 
and the operating code for the second set of software is stored as firmware in the instruction set ROM 37 of the controller 
chip 13. A general memory map for.the microprocessor is included as Appendix "A," and it provides information as to 
the various memory elements used by the microprocessor. 

As indicated in Appendix "A," the external RAM chip 18 of FIG. 1 has storage space for approximately 16,000 
bytes of software, whereas the instruction set ROM 37 (FIG. 3) is only about half that size. This is because in the 
preferred embodiment, the external RAM chip is used as a first memory location for full-featured software that can be 
tailored to the patient's condition and can provide many specialized functions. By contrast, the primary purpose of the 
preferred backup firmware stored in the instruction set ROM is to provide default, un-tailored, tachyarrhythmia and 
bradycardia detection and therapy. As mentioned earlier, software error is extremely rare and, thus, the preferred 
implantable device will almost always operate in its first, RAM mode. However, the backup firmware, firmware being 
defined as software stored in ROM, provides additional life-security in the event of a software error. If an unlikely error 
is detected, the control unit 11 will sound an alarm to indicate that the patient should contact his or her physician, so 
that the error can be properly addressed. 

Preferably, both sets of code are programmed into the system during manufacture. As programmed in the factory 
the device is left in a storage mode, in which it provides null values as a pacing output and returns null values as 
sensory inputs. Thus, when operating in this manner, the device provides no stimuli and uses little power. While on 
the shelf and prior to implantation, its battery life is not significantly reduced. At implantation, the device is configured 
via the telemetry circuit 21 so as to provide actual pacing stimuli. Further, the telemetry circuit is utilized to load, if 
necessary, new software and parameters into the external RAM chip 1 8 or the internal RAM 38. 

Certain critical basic software functions (not illustrated in the accompanying figures) are required for both the first 
and second modes of operation, and they are stored in the instruction set ROM 37 regardless of the current mode. 
Examples of these crilical basic functions are: 

1 . A watchdog acknowledgement routine. 

2. A telemetry mailbox service routine (protocol). 

3. A routine for the checksum operation. 

4. A reset routine, as well as other small functional routines. 

Certain features of these routines considered important to an understanding of the preferred embodiment are 
discussed below, most notably, the features which relate to correct watchdog acknowledgment. Otherwise, it is believed 
that the precise structure of the four mentioned routines will vary depending upon the particular implementation and 
can be easily written by one having ordinary skill in logic design. 

When the telemetry circuit 21 has access to the system, it can be used to change the mode of the implantable 
device, e.g.» place it in any of the first, second or third modes. It does this by causing the microprocessor 19 to configure 
its control registers, including registers 53 and 54. which are detailed in FIGS. 6 and 7. Importantly, the second least 
significant bit of the control register 53, labeled in FIG. 6 as "RAM/ROM mode," indicates whether the device is operating 
in the first RAM mode or the second, backup ROM mode. When the bit is se1 to "1 ," the microprocessor will look to a 
first vector table using the bit together with pointers located at 80E080FF hex (a range ot memory locations), and 
determine that its non -administrative functions are defined in the external RAM chip 18 at address locations 03003FFF 
hex. Alternatively, if this bit is set to "0," as it is upon a power-on reset, the device operates in the second mode, and 
the microprocessor determines from the bit that it must look to a second vector table, which points only to the ROM 
37 (A000-BFFF hex), for all of its functions. Importantly, whichever vector table the microprocessor uses will always 
direct it to the instruction set ROM 37 lor Ihe four routines mentioned above, including the watchdog acknowledgement 
routine. 



6 



...0750921 A2J_> 



EP 0 750 921 A2 

Both of the vector tables are stored in the 64-byte vector ROM 40, which also is located on the controller chip 1 3. 
The upper 32 bytes of this latter memory are used to store interrupt vectors to be used as part of the first, RAM mode 
interrupt service routine pointers. By contrast, the lower 32 bytes contain corresponding pointers to be used in the 
second, ROM mode; these latter pointers instead direct the microprocessor 1 9 to the second instruction set. The vector 

5 ROM can be accessed by the microprocessor 1 9 using a data fetch and a vector fetch. 

Referring now to FIG. 4, the use of microprocessor resets and error detection mechanisms will be described. Reset 
logic 50 is employed to interrupt the microprocessor 19 and peripheral logic 43 by providing a system reset signal 
(labeled "SYSRESET" in FIG. 4) after a first software error has been detected. This causes the microprocessor and 
peripheral logic to set the "RAM/ROM mode" bit either with a logical "1" if the telemetry circuit 21 has just written a 

10 special code to the internal RAM 38, or to leave it at the default value of a logical "O," otherwise. If the RAM/ROM mode 
bit is set to zero, the microprocessor will thereafter operate only upon the ROM code as directed by the second vector 
table. If the system reset represents a second error, the system is placed in the third mode of operation (where fixed- 
rate pacing is applied) when the watchdog circuit 41 freezes the microprocessor clock with its "EWI" signal. This can 
also be forced by telemetry, which can cause reset logic to raise the system reset and keep it raised. This freezes the 

is operation of the microprocessor, and the watchdog circuit 41 raises the "EWI" signal to trigger the third, fixed-rate 
pacing mode of operation. 

When the telemetry circuit 21 asserts the reset, the watchdog circuit 41 is initialized, which includes resetting error 
flags in a special watchdog status register (pari of the watchdog circuit of FIG. 4). This watchdog status register stores 
eight bits, each acting as an error flag and representing one of the following conditions: watchdog timeout error; multiple 

20 acknowledge error; password error; second parity error; first parity error; processor-caused second system reset; and 
processor-caused first system reset. While reset is asserted, the system remains in the EWI mode, and the telemetry 
circuit can write as specific flag byte to predetermined memory location in the internal RAM 38, to put the implantable 
device in the first, RAM mode. When the reset signal is eventually lowered, the microprocessor 19 executes its reset 
routine, which causes the microprocessor and its peripheral logic 43 to read the predetermined memory locations to 

25 look for the specific flags. If the flags are present, the microprocessor clears the flags and modifies its register 53 value 
to set the RAM/ ROM bit to a logical "1." The microprocessor thereafter operates to check the first vector table to 
determine where its operating instructions reside. 

Importantly, change between modes also causes the patient to be informed of the change using different audible 
alarms. If the second mode is being used, a first alarm is used to indicate that an error has occurred; if the third mode 

30 has been entered, a different alarm informs the patient that an error has occurred; in both cases, the error is urgent 
and the patient should immediately inform his or her physician. As will be discussed further below, the audible alarm 
circuit 45 provides these various indications and, further, provides indications of (1 ) a low battery condition, and (2) the 
imminent application of anti-tachyarrhythmia therapy. This latter alarm is very important because anti-tachyarrhythmia 
therapy can Include application to the heart of shocks of several hundred volts, and the patient must be forewarned of 

35 its occurrence. 

The system bus 26 also provides the microprocessor 19 and telemetry circuit 21 with access to both the I/O chip 
15 and the high-voltage chip 17. The I/O chip 1 5 (FIG. 5) is a self-sufficient chip that remains operating notwithstanding 
error in the controller chip 1 3. As mentioned previously, it includes microprocessor-controlled pacing circuitry 29, which 
takes microprocessor orders to supply stimuli to the heart in each of the first two modes of operation of the implantable 
40 device. In addition, monitoring circuitry 27 provides sensed heartbeat information to the microprocessor 1 9 and to the 
EWI state machino 31. Finally, the EWI state machine takes charge, in the presence of the EWI signal, to supply 
fixed- rate pacing when the device is in the third mode. 

As shown in FIG. 5, the microprocessor-controlled pacing circuitry 29 includes a set of pulse control registers 55, 
which receive rate and amplitude instructions from the microprocessor 19. Together with this information and clock 
45 signals obtained from the system clock 49 (located on the controller chip 13, FIG. 2), the set of pulse control registers 
generates amplitude and timing cues that cause the output logic 33 to supply electrical stimuli to the heart, exactly as 
desired. 

The output bgic 33 includes pulse control logic 57 for receiving timing and amplitude cues. The pulse control logic 
controls the charging and release of a charge pump 59. which generates the actual voltages that will be applied to the 
50 heart for pacing, as well as for anti-bradycardia therapy and some anti-tachyarrhythmia therapy. The output of the 
charge pump 59 is gated by output switches 60 and 61 , as appropriate, to output channels for the atrium and the 
ventricle. 

When the implantable device is in the third, EWI mode, the microprocessor 1 9 is frozen by the EWI signal from 
the watchdog circuit 41 (FIG. 4) and the EWI state machine 31 is made operational. The EWI signal will cause the 
55 state machine to supply fixed-rate pulses to the pulse control logic 57 (FIG. 5). The EWI state machine receives a 
constant clock input <p and, when the EWI signal Irom the watchdog circuit is high, the EWI state machine generates 
fixed-rate stimuli only if the heart fails to beat on its own within a predetermined interval. Hysteresis rate, EWI pulse 
rate, EWI-mode sense amplitude, and other variables commonly associated with fixed-rate pacing are hardwired 
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inputs provided by the EWI state machine. 

Whichever mode the implantable device is operating in, when it is not supplying stimuli to the heart, the two channels 
to the heart are monitored by monitoring circuitry 27, including atrial and ventricular sense circuits 62 and 63. These 
are coupled to the EWI state machine 31 , to assist with demand pacing, as described, and also to the system bus 26, 

5 to provide the microprocessor 19 with heartbeat information, which it will use to provide automaticity functions. The 
microprocessor also can use these sense circuits to apply automatic sensing of thresholds in a well-known manner. 

In addition to the I/O chip 15, the microprocessor 19 and telemetry circuit 21 also communicate with the high- 
voltage chip 17 and its anti-lachyarrhythmia circuit 35 (FIG. 1). If appropriate, in response to sensed heartbeat infor- 
mation provided by the I/O chip 1 5, the microprocessor can cause the anti-tachyarrhythmia circuit to apply one or more 

10 high-voltage shocks to the heart. I n the preferred device 1 1 , the second, ROM mode analyzes heartbeats using sudden 
onset criteria to distinguish pathological tachyarrhythmia from exercise and stress. If the heartbeat quickens in too fast 
a manner, the sudden onset criteria is satisfied and leads to anti-tachyarrhythmia therapy. Three alternative therapies 
are preferably provided for use in the second mode, one for each ol throe tachyarrhythmia heartbeat regions, as will 
be discussed below. As a result, the microprocessor can gauge whether the tachyarrhythmia is severe and can apply 

is therapy tailored to the particular condition. In the primary mode of operation, the first set of software can be tailored 
to the particular patient's condition and can provide anti-tachyarrhythmia or anti-bradycardia therapy, as appropriate. 
In the paragraphs that follow, the error detection, watchdog, reset, and alarm functions will be further described. 
As mentioned above, the implantable device includes an advanced error detecting mechanism. The preferred 
control unit 1 1 has three error detection schemes. Two of these schemes, implemented by parity logic 39 and afirmware- 

20 based checksum error detecting operation (performed by the microprocessor 19), detect software errors. The third 
scheme implemented by the watchdog circuit 41, responds to software errors and also detects hardware errors. 

The parity logic 39 checks the internal 3K-by-nine bit RAM 38 for errors. The ninth bit of each byte is used as bit 
storage for odd parity. When a byte of data is written into the RAM, the parity bit is generated and written into the RAM 
automatically. When a byte of data is read from the RAM, the parity bit is checked against the data being read. A parity 

2£ error check is performed by the parity logic 39 each time data is retrieved from the internal RAM 38 and, upon occurrence 
of an error, the parity logic 39 informs the watchdog circuit 41 by sending to it an error signal labeled "PERRINIT* (FIG. 
4). Parity logic construction and the use thereof are well known in the electronic arts. 

The firmware-based checksum operation regularly checks the sum of the contents of external RAM chip 1 8. When 
a checksum error is detected, the microprocessor 1 9 informs the watchdog circuit 41 via the system bus 26, indicated 

30 with the word "DATA" in FIG. 4. 

The watchdog circuit 41 handles errors from either of these two mechanisms using logic that generates an error 
signal. This error signal is sent to the reset logic 50 upon each occurrence of either a parity error or a checksum error 
This logic also keeps track of the number of such errors and, upon occurrence of the second error from either the 
microprocessor 1 9, the parity logic 39, or a combination of them, it raises a third mode signal, labeled EWI in FIG. 4, 

35 and It maintains this signal in a raised state. The EVVI signal is provided to the EWI state machine 31 and to the 
audible alarm circuit 45. 

Entering the EWI state, the watchdog circuit 41 freezes the microprocessor 1 9 via clock control logic (not shown) 
(thus preventing it from controlling pacing), activates the EWI state machine 31 (thus causing it to supply fixed rate 
pacing in the third mode of operation as described above), and causes the audible alarm circuit 45 to generate a 

40 periodic audible alarm, to inform the patient that the third mode has been entered. As mentioned above, the third, EVVI 
mode can be reset only via the telemetry circuit 21; therefore, if tho third mode is entered, the implantable device will 
stay in that mode until the patient returns to the physician, who can use the telemetry circuit to diagnose the cause of 
system error. The physician also can load the parameters and/or new software into the internal RAM 38 and external 
RAM chip 18, if appropriate. As previously mentioned, the telemetry circuit clears the EVVI signal and places the 

45 microprocessor 1 9 once again in the first mode of operation. 

One portion of software that is always obtained from the ROM 37 and relied upon by the microprocessor 19 is the 
watchdog acknowledgment routine. The watchdog circuit 41 relies upon real-time counters 51 so that it can time and 
assert, if appropriate, an active-high signal upon the expiration of each two-second period. Prior to the expiration of 
the two-second period, it is expected that the microprocessor will execute the watchdog reply routine to send an ac- 

50 knowledgment to the watchdog circuit. If the acknowledgment is properly received, then the watchdog's interrupt coun- 
ter is cleared and a new two-second watchdog cycle is commenced. However, if the microprocessor has failed to 
properly acknowledge the watchdog circuit, in the detailed manner that will be described below, then the watchdog 
circuit raises an error signal (labeled 'ERRINIT" in FIG. 4) and the EVVI signal, which it keeps in a raised state, to 
cause the EVVI state machine 31 to take control of fixed-rate pacing. 

55 With reference to FIG. 4, the particular watchdog scheme used, and in particular, the acknowledgment, is shown 

to be actually more complicated than in many other digital systems, since the acknowledgment is coded to ensure 
proper operation of the microprocessor and peripheral logic 43. Each time the microprocessor 1 9 sends an acknowl- 
edgment signal, it retrieves from the watchdog circuit 41 a random password generated by the watchdog circuit for the 
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subsequent acknowledgment (at system initialization, the password is initialized to be "00H"). Further, it calculates one 
of four address locations from the password, which must be correctly written to in order to reset the watchdog interrupt 
counter. If the microprocessor fails to write the correct password to the correct location, or if it writes the correct password 
to more than one location, prior to the next "TIC J NT" pulse, then the watchdog circuit detects a hardware error and 

s places the system in the third mode. 

When the microprocessor and peripheral logic 43 have correctly acknowledged the watchdog circuit 41, they re- 
trieve the next randomly generated password and recalculate the associated response location and store these in 
RAM, continuing with the previously interrupted operation. The watchdog circuit 41 will reset the walchdog interrupt 
counter if the acknowledgment has been properly performed as described, and it will await the next two-second real 

10 time period. 

As can be seen, the watchdog circuit 41 performs the important function in the preferred embodiment of directing 
entry into the hardware-controlled EWI mode when a hardware error has been detected, or (in cooperation with the 
microprocessor 19) when a second software error has been detected. It is expected thai those two occurrences will 
constitute exceptional instances, and that the bulk of any errors that might occur will be software errors, handled by 

is entry into the second mode, importantly, if the microprocessor stops operating for any reason, the watchdog circuit is 
effective to trigger entry into the third mode, where the EWI state machine 31 applies fixed-rate pacing. 

The error detecting mechanisms of the invention are not limited to use of a parity error check, implemented by the 
parity logic 39, or the checksum operation, or the watchdog circuit 41 . Rather, the error detecting mechanism (within 
the scope of the invention) can be anything that detects error in logic or a computer circuit. For example, it may also 

20 include error correcting codes or cyclical redundancy checksums, or any combination of error detection mechanisms 
as known in the art. Whatever the error detection mechanism, all that is required is an implantable device that detects 
error in the first set of operating instructions, or in its execution, and that causes its controller to instead take operating 
instructions from a different source. 

The control unit 11 has different alarms that it preferably uses to alert the patient to the various operating conditions 

25 of the implantable device. In accordance with the invention, one alarm alerts the patient that a software error has 
occurred and that the patient should see his or her physician to have the error investigated and corrected. A different- 
sounding alarm is used when the device is in the third, EWI mode, and it indicates that the patient should immediately 
notify his or her physician and have the situation corrected. Other alarms can be used in response to other conditions 
of the device, as is discussed below. In the following paragraphs, the alarm circuitry will first be described, followed by 

30 the particular alarms utilized in the preferred embodiment. 

The alarms are audibly generated within the control unit, mounted in the patient's chest, by a piezoelectric trans- 
ducer, which can emit high Irequency tones or low frequency vibrations. The actions of the transducer are defined and 
controlled by a number of factors, including: 

35 (1 ) Whether the microprocessor 19 is enabled (i.e.. the implantable device is operating in one of Its first two modes 

of operation); 

(2) Whether the anti -tachyarrhythmia circuit 35 (FIG. 1) is being charged; 

(3) The desired duty cycle for the sounding the alarm, which may be loaded by software or hardwired; 

(4) Whether the alarm is enabled; and 

AO (5) Whether a high frequency tone or a low frequency vibration is generated by the transducer. 

These various functions are controlled by loading values into three 8-bit alarm control registers 65, 67 and 69 
(8060-8062 hex, illustrated in terms of the bit-function in FIGS. 8-10), and alarm logic drives the alarm, as described 
below, in response to the values stored in these registers. The registers preferably are written to by the microprocessor 
45 19, to allow software to define the parameters of the alarm, and 1hey also have corresponding hardwired values for 
use in the third. EWI mode. 

Referring first to FIGS. 6 and 9. the first two of the three alarm control registers 65 and 67 are used to set the 
nature of the tone to be emitted by the piezoelectric transducer. 

First, the duty cycle for the alarm is set as follows. Referring first to FIG. 8 (alarm control register 1), the five LSBs 
50 control the length of time for which the piezoelectric transducer receives a high signal; by contrast, in FIG. 9 (alarm 
control register 2), the five LSBs indicate the amount of time that the piezoelectric transducer receives a low signal. 

Between these two groups of five bits, a duty cycle is defined for the alarm to drive either the high or low tone. 

Second, the high frequency tone that can be emitted by the transducer is exactly 64 times higher in frequency 
than the low frequency tone, and it is selected by writing a logical "1°to the first MSB of alarm control register 2 (FIG. 9). 
55 As to the rest of alarm control register 1 (FIG. 8), the most significant bit (MSB) switches the alarm on when loaded 

with a logical "1 ' value and causes the transducer to vibrate. The second MSB is normally loaded with a logical "0" to 
provide selective microprocessor-control for the alarm, but it is overridden by the antt-tachy arrhythmia circuit 35 to 
provide a high-voltage charge alarm, indicating that the patient should stop all hazardous activities, such as driving a 
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car, in preparation for a shock. The tones tor this latter alarm are defined by hardware, and they are generated after 
the microprocessor 19 has determined that antkachyarrhythmia shocks are necessary and has directed the high- 
voltage chip 17 to begin storing energy for a large shock to be delivered to the heart. In accordance with common 
practice, the patient can be provided with a magnet that can be used to forestall the large shock until the patient is 
5 prepared for it. 

The third alarm control register, as indicated in FIG. 10, includes two MSBs, which can be read and written to by 
the alarm control circuit 45, and six status bits that can be read by the microprocessor 19 or the telemetry chip 21 . The 
first MSB is written to by the alarm control circuit 45 to raise il lo a logical '1 " when the "EWI" signal has been raised, 
indicating the implementation of hardware-controlled pacing and deactivation of the microprocessor. The second MSB 
10 is used to provide an alarm "blip" of short duration, but this latter alarm is generally used only for testing purposes. 

The aforementioned registers and circuitry permit selection of five different alarm modes by the alarm control logic. 

First, whenever the implantable device enters the third mode, indicating hardware-controlled pacing and no anti- 
tachyarrhythmia or bradycardia functions, an alarm is sounded that consists of a 250 millisecond, 819-hertz beep and 
a two-second, 1 2,7-hertz vibration, both occurring together every eight minutes and 32 seconds. The sounding of this 
is alarm indicates that the patient should return to the physician's office, because hardware-controlled pacing has been 
implemented as a backup caused by failure of the microprocessor 19, likely a hardware failure. 

In a second alarm condition, the microprocessor 19 can sound the aforementioned "blip," which provides a high- 
frequency tone lasting for 62.5 milliseconds. This "blip" can be used for testing or to indicate system status, as might 
be desired in a particular implementation. It has not been implemented to represent a particular condition in this pre- 
20 ferred embodiment, however. 

In a third alarm condition, a high-voltage charge alarm, different from the EWI alarm, is sounded. This alarm 
consists of a series of 62.5-millisecond high pitch tone bursts superimposed on a lowpitch tone vibration. As mentioned 
above, the sounding of this alarm indicates to the patient that the high voltage chip's anti-tachyarrhythrnia circuit 35 
has been activated and is preparing to deliver a large shock to the heart. 
25 The fourth alarm condition is entered when the microprocessor 1 9 exits the first, RAM mode and enters the second, 

ROM mode, indicating a detected software error that should be reported to the physician, who may wish to see the 
patient. This alarm also is sounded if a low battery condition has been detected by the microprocessor. 

Finally, the microprocessor 1 9 can, in proper functioning of its programming, indicate a microprocessor^ontrolled 
EWI alarm, such as to indicate a different error, or otherwise to inform the patient that he or she should return to the 
30 physician's office; i.e., for a periodic checkup. This mode also has not been implemented in (i.e., called by the software 
of) the preferred embodiment. 

Arrhythmia detection and therapy is one of the automaticity features of the present invention, and is provided for 
not only in the normal, RAM mode, but also in the backup, ROM mode. In each of these modes, arrhythmia is detected 
by analyzing heartbeat rate and classifying it into a zone identified by Table I, below, determining and applying appro- 
35 prlate therapy, and determining when the criteria for termination have been satisfied. Further, therapy can consist of 
pacing stimuli, applied by the I/O chip 15, or high-voltage shocks, applied by the high-voltage chip 17. These options 
will be explained below, accompanied by an explanation of some of the programmable features of the anti-tachyar- 
rhythmia scheme provided in the backup mode. 

Importantly, although the microprocessor 19 only executes the code stored in the ROM 37, its features can be 
to programmably defined using the telemetry circuit 21. In particular, when operating in the second, backup mode, the 
microprocessor still retains a minimal work space in the internal RAM 38, for stack and data storage, and telemetry 
can be used to configure operating parameters using the internal RAM 38. Indeed, telemetry can be used to program 
a number of features of the arrhythmia rate zones, as will be discussed below, after the device enters the ROM mode, 
parameters can be changed after the device enters the ROM mode by using telemetry to store parameters in the 
45 internal RAM 38. 

The second, ROM mode provides anti4achyarrhythmia abilities for each of four arrhythmia rate zones. As men- 
tioned above, this scheme (indicated in Table I) preferably will be made factory-standard for the implantable device. 
Software for the first, RAM mode can be made either to duplicate this particular scheme or to implement a different 
scheme, such as providing specialized bradycardia therapy, etc. By communicating through the telemetry chip 21. a 
50 physician can selectively disable tachyarrhythmia zones ('VT1 " and *VT2 n ) by writing a predetermined command to a 
specific location in the internal RAM 38. In this event, there is no discontinuity in the scheme shown in Table I, and the 
criteria for the disabled zone are subsumed by the immediately higher-order enabled zone. 
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TABLE I (continued) 



10 



is 



20 



25 



30 



35 



40 



45 



50 



55 



RATE ZONE 


LOWER LIMIT 


Upper Limit 


VT2 


200 BPM 


240 BPM 


VT1 


150 BPM 


200 BPM 


NORMAL SINUS 


50 BPM 


150 BPM 


| BRADYCARDIA 


-NA- 


50 BPM 



Importantly, tachyarrhythmia and bradycardia therapy and diagnosis are well known in the art, and a detailed 
understanding of their operation is not considered essential to an understanding of the present invention. However, 
for purposes of illustration, tachyarrhythmia diagnosis and therapy will be briefly explained with reference to FIG. 11 . 

The backup, ROM mode distinguishes exercise and physiological tachyarrhythmia from tachyarrhythmia by ana- 
lyzing the heartbeat rate for sudden onset. The microprocessor 19 computes an average time interval between the 
four most recent. If the time interval to the next heartbeat occurs quickly enough that it represents a tachyarrhythmia 
rate (see Table I), and if it is also less than a predetermined percentage of the four-interval average, then sudden onset 
is detected. Using this procedure, a fast heartbeat caused by stress or exercise may be differentiated, because it 
quickens in a slower manner than a dangerous heart condition. 

Importantly, the sudden onset criteria is applied only to the lowest enabled tachyarrhythmia zone, generally that 
labeled "VT1" in Table I, above. A single interval satisfying the criteria for a higher-order zone will trigger therapy 
appropriate for that zone. After a tachyarrhythmia has been detected, the microprocessor 1 9 will analyze to determine 
if the tachyarrhythmia has ended. The microprocessor must determine that eight consecutive heartbeat intervals falling 
below any tachyarrhythmia zone have elapsed. In addition, the microprocessor must determine that six consecutive 
averages of the four most recent heartbeat intervals produce times below the lowest tachyarrhythmia threshold. 

In addition to the use of sudden onset, the implantable device provides a number of programmable features that 
enable a physician Lo vary the type of tachyarrhythmia detection and therapy provided in the second, backup mode. 
For example, stability detection criteria can be implemented for tachyarrhythmia rate zones as either "detection,' 1 "sta- 
bility" or "off/ If "detection" is the programmed value, then an arrhythmia is not detected until the stability criteria, 
mentioned below, has been satisfied lor that particular zone. If "therapy' is the programmed value associated with the 
stability criteria for the particular zone, then either anti-tachyarrhythmia therapy or alternative high voltage shocks may 
bo applied, depending upon whether the stability criteria are satisfied. For example, it in conjunction with the use of 
sudden onset detection, a tachyarrhythmia is detected as being stable within the "VT2" zone, then anti-tachyarrhythmia 
therapy might be advisable for the particular patient's condition. 

Alternatively, if for the particular patient high variance in heart rate is indicative of a malignant condition, then failure 
to meet the stability criteria for the particular tachyarrhythmia zone might require the application of high voltage shocks, 
as opposed to specialized anti-tachyarrhythmia therapy. Finally, stability criteria may be programmed as "off" for the 
particular zones. 

Stability as used in connection with the backup software of the implantable device, is defined as the lack of variance 
in heartbeat rate. If the variance for six consecutive four-heartbeat interval averages is less than or equal to a prede- 
termined time period, then tachyarrhythmia rate zones are enabled, and each average is grouped according to zone 
until a number of six averages falls within one zone. Thus, once the low variance triggers stability analysis, the stability 
criteria is satisfied when six instances are identified in a particular zone. The bins used to count these averages are 
then cleared for subsequent stability detection. 

All of the above-mentioned programmable features, along with the other programmable features discussed herein, 
can be set using the telemetry circuit 21 , which writes a predetermined code to a specific RAM location while telemetry 
has control of the system. As mentioned earlier, as telemetry releases control of the system, a reset of the microproc- 
essor 19 is triggered and the microprocessor checks the internal RAM 38 for the presence of these codes, clearing 
them as it does so. The start-up software of the microprocessor causes it to do this and appropriately configure its 
registers (not shown) lor operation of the device 11 when it is in the second, backup mode. Accordingly, at the time of 
implantation, the telemetry circuit can be used not only to put the implantable device into a first operating mode, but 
also to select particular anti-tachyarrhythmia detection and therapy as might be appropriate for the particular patient. 

Therapy is preferably separately handled by software for each of the "VT1 " and m VT2 n rate zones specified in Table 
1, whereas zone tt VF" corresponds to ventricular fibrillation, and defibrillation is always applied using the high-voltage 
chip 17. Within Ihese zones, three different stages ol therapies can be applied, and any of these therapies can be 
enabled or disabled, as can the particular rate zone. Importantly, if a tachyarrhythmia zone is disabled, sudden onset 
and stability criterion are applied to the next-highest rate zone, e.g.. U VT2. H 

When tachyarrhythmia is detected in a particular zone, the implantable device begins to apply first stage anti- 



11 



BNSCOCID. <EP 0750821 A2J.> 



EP 0 750 921 A2 

tachyarrhythmia therapy, then second stage, then third stage, if these stages are enabled, until an end to tachyarrhyth- 
mia has been determined, or a higher rate zone has been detected. For example, when tachyarrhythmia is detected 
within the B VT1 ■ zone, a number of 0.25-11 volt pulses can be applied by the I/O chip 15 to the "R-wave" of the heartbeat 
at a programmable amplitude and duration. The number of stimuli (1-15) can be programmed, as well as the interval 

5 between applying a second stage of therapy if tachyarrhythmia Is not ended. The second stage of therapy has the 
same programmable parameters as does the first, and may be programmed using the telemetry circuit 21 , in response 
to the particular patient's condition. 

Each of the "VT1 " and *VT2 m zones has an associated real-lime counter 51 (FIG. 3), and after the third stage of 
therapy has been given, no further therapy is given. Expiration of the associated timer (without a detected end to 

10 tachyarrhythmia or reclassification as part of a higher zone) automatically causes entry into the higher zone (i.e. , either 
"VT2* or "VF"), 

Alternatively, therapy can include from 1 to 7 high-voltage shocks, applied by the high-voltage chip 17. These 
shocks are programmable in voltago (56-756V), shock numbers (1, 2, 3 and 4-7), and duration. In addition, shock 
morphology can also be programmable as monophasic or bi-phasic, as is known in the art. Following the application 
75 of shock therapy, the rate bins and counters are blanked and no therapy is provided for a programmable amount of 
time, which is at least one second. Thereafter, bradycardia therapy is provided, e.g., demand pacing. 

During the time that a tachyarrhythmia has been detected, a count is kept of the number of consecutive averages 
that occur below the lowest programmed tachyarrhythmia rate zone. A single average falling within an enabled tachy- 
cardia zone of Table I breaks this count, and causes it to begin again. If six consecutive averages fall below the lowest 
20 enabled tachycardia zone (i.e., the count reaches 6), then classification within the particular tachycardia zone is con- 
sidered to be terminated. If, in addition, eight consecutive heartbeat periods falling below any tachyarrhythmia zone 
have elapsed, then tachyarrhythmia is considered ended. 

The present invention is not limited to the use of instruction sets that are stored in the ROM 37 and the internal 
RAM 38. All that is required is that two alternative sets of instructions be available for additional reliability in case of 
25 error, and any type or number-of memory elements can be used to make those instructions available. 

One alternative embodiment presently contemplated is to use a RAM to store the first set of operating instructions 
for the microprocessor 1 9, and a second memory that stores the second set ol software in a compressed format. Upon 
detecting an error, the microprocessor would operate to reboot, decompress the compressed, second program set, 
and write the newly de-compressed second program set into RAM. to thereby overwrite the first program set. The 
30 program memory for storing the second, compressed set of program instructions could simply be another ROM, and 
such a system would be, in terms of its schematic representation, exactly like that shown in FIG. 1 . The notable ex- 
ception to this, however, is that code for decompressing the second set of software and loading it into RAM would 
preferably be itself stored in an additional ROM. 

In addition, the present invention is not limited to the use of providing a particular backup therapy, e.g., tachyar- 
35 rhythmia pacing or shocks, but can include any automaticity or desired functions that would normally be lost when the 
microprocessor 1 9 is shut down in response to a detected error. As another contemplated alternative embodiment, the 
second set of software stored in the internal ROM 37 can provide primarily for sophisticated anti-bradycardia therapy, 
or other particular therapy, as appropriate. 

Having thus described several exemplary embodiments of the invention, it will be apparent that various alterations, 
40 modifications, and improvements will readily occur to those skilled in the art. 

As one example, tho hardware features of the present invention can be implemented as software features, and 
vice-versa, without departing from the scope of the invention. 

Attached hereto as Appendix "A" is a memory map tor the preferred device 1 1 . 

Attached hereto as Appendix "B" is a Interrupt Vector ROM summary for the preferred device 11 . 
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AFPENDIX A 



70 



75 



20 



25 



30 



35 



40 



45 



ADDRESS 



DESCRIPTION 



SIZE 



12*K Exter- 
nal RAM — 



3K Internal 
RAM 



r 



OOFFh 


PageO 


256 Bytes 


OlOOh 
OlFTh 


Page 1 Stack 


256 Byies 


0200b 
02FFh 


Telemetry Buffer/General RAM 


256 Bytes 


0900b 
3FFFK 


External RAM eoramom 
aiea for code, parameter*. 


15616 Bytes 


4000b 


Data Banfci I throuf h 1 are all mapped into 
this address range. Each bank contains 16K 

bytes. 


16K Bytes 


SOOOh 
80FF>i 


Internal Hardware Registers 
& Vector ROM 


236 Byres 


SlOOh 
SlFFh 


External I/O I (HVQ 


256 Bytes 


8200h 
52rTe 


Externa! I/O 2 (ElO) 


256 Bytes 


&3O0h 
B3FFh 


External VO 3 (RSVD) 


256 Bytes 


S4O0h 
WFFh 


External I/O 4 (RSVD) 


256 Bytes 


5500h 

9vm 


Reserved Hardwire Address Space 


6912 Bytes 


AOOOh 
BFFFh 


SK External ROM 


8192 Bytes 


g COOOh 
COlFh 


Product ID's. Model #. and Serial # 


32 Bytes 


C020h 
B CBFB 


Internal RAM 


3040 Bytes 
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Interrupt Vector ROM 



Address 


Name 


Type 


Reset Condition 


Reset Value 


Description 


BOEOh 
I 

80FT* 


Veciof ROM 


R 


N/A 


N/A 


The vector rom contains two scu. or 
32 - byre lAierrupi veciorv Both «u of vec- 
tors arc mapped to the same addren. i ante I 
The RAM_ROM* bit in the control regtv I 
ter 1 doet The selection. 



Claims 

1. An implantable device that provides an electrical stimulus to the heart, comprising: a sensor that senses a body 
condition; a controller that electrically controls at least one of amplitude and timing of a stimulus provided to the 
heart in response to the sensed body condition; and an output circuit coupled to the controller and to the heart to 
provide the stimulus thereto; characterised by: two alternative sets of instructions that determine operation of the 
controller, the controller responding to a first set of instructions normally and switching to the second set in the 
event of a detected error in the operation of the implantable device; and an error detecting means that detects 
error in the operation of the implantable device and causes the controller to switch to utilize the second set in 
response to the detection of error; wherein the two alternative sets of instructions each provide aulomaticity to 
enable the controller to vary at least one of magnitude and timing of the electrical stimulus in response to sensed 
body conditions. 

2. A device as claimed in Claim 1 , characterised in that the sensor provides an indication of heartbeat and the two 
alternative sets of instructions each include either a routine for detecting tachyarrhythmia and for applying anti- 
tachyarrhythmia therapy, or a routine for detecting bradycardia and for applying anti-bradycardia therapy. 

3. A device as claimed in Claim 1 or Claim 2, characterised by a fixed-rale pacing circuit thai is activated by the error 
detecting mechanism if a detected error in the operation of the device is detected and that exclusively determines 
the one of amplitude and timing of the stimulus provided to the heart. 

4. A device as claimed in any preceding Claim, characterised in that the controller includes a microprocessor. 

5. An implantable device that provides an electrical stimulus to the heart, comprising: a sensor that senses a body 
condition; a controller that, in response to the sensed body condition, provides an output signal indicating one of 
timing and amplitude of a stimulus to be provided to the heart, in accordance with a set of stored instructions; and 
an output circuit that receives the output signal and that is operatively coupled to the heart to provide the stimulus 
thereto in response to the output signal; characterised by: a first memory having a first set of stored instructions 
that controls operation of the controller; a second memory having a second set of stored instructions that controls 
operation of the controller; and an error detecting mechanism that is operatively coupled to at least one of the 
controller and the fist memory, to detect the occurrence of an error in the operation of the device, in order to detect 
possible corruption of the first set of stored instructions, the error detecting mechanism providing an error indication 
in response thereto; wherein the controller operates in a first, normal mode of operation, in response to the first 
set of stored instructions when there has been no error indication, and also, in a second, backup mode, in response 
to the error indication in which the operation of the controller is governed by the second set of stored instructions; 
and wherein the controller continues, in response to the sensed body condition, to provide an output signal indi- 
cating one of timing and amplitude of the stimulus to be provided to the heart, notwithstanding the error indication. 

6. A device as claimed in Claim 5, characterised by an alarm that is activated when the device changes from the first 
mode to the second mode. 
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7. A device as claimed in Claim 6, characterised in that the device further comprises: a third mode ot operation where 
the device provides a fixed-rate pacing to the heart; and two different alarms, including a first alarm that is activated 
when the device is placed in the second, backup mode and a second, different alarm that is activated when the 
device is placed in the third mode. 

8. A device as claimed in any of Claims 5 to 7, characterised in that: the error detecting mechanism also detects 
occurrence of a second error in the operation of the device, thereby to detect a second possible corruption of 
stored instructions as well, and supplies a second error indication in response thereto; and the device further 
comprises a fixed-rate pacing circuit, and a third mode of operation, in which the stimulus is not provided to the 
heart in response to the output signal of the controller, but is instead provided to the heart at a fixed rate determined 
by the fixed-rate pacing circuit; wherein the device enters the third mode of operation in response to the second 
error indication. 

9. A device as claimed in Claim 8, characterised in that the sensor includes a heartbeat sensor and the fixed-rate 
pacing circuit generates the fixed-rate signal on a demand basis, which causes the stimulus to be supplied to the 
heart in accordance with a fixed rate in response to the heartbeat sensor 

10. A device as claimed in Claim 8. characterised in that the device further comprises a watchdog circuit coupled to 
the controller, the watchdog circuit periodically requiring correct acknowledgement from the controller and, if no 
correct acknowledgement is received, causing the device to change to the third mode. 

11. A device as claimed in Claim 10, characterised in that the watchdog circuit is configured such that, for a period 
associated with each correct acknowledgement, if more than one acknowledgement is received, the watchdog 
circuit causes the device to change to the third mode. 

12. A device as claimed in any of Claims 5 to 11, characterised in that the device further comprises a register that 
stores data which determines the mode of operation of the controller and a telemetry circuit that selectively receives 
communication from the exterior of a body in which the device is implanted, the telemetry circuit being arranged 
to change the data stored in the register in response to selective communication; whereby the telemetry circuit 
causes the device to change the dependence of the controller upon one of the first and second sets of stored 
instructions to the other. 

13. A device as claimed in Claim 5, characterised in that: the sensor is a heartbeat sensor that provides an input signal 
representing heartbeat; the first set of instructions causes the controller to monitor the input signal to detect a 
tachyarrhythmia and/or a bradycardia condition; the second set of stored program instructions also causes the 
controller to monitor the input signal to detect a tachyarrhythmia and/or a bradycardia condition; and the device 
further comprises anti-arrhythmia means for applying anti-arrhythmia therapy to the heart in response to detection 
of the condition. 

14. A device as claimed in Claim 13, characterised in that the device further comprises means for detecting at least 
two different gradations of tachyarrhythmia and when the device is in the first mode, the first set of instructions 
causes the device to apply a different anti-tachyarrhythmia therapy to the heart for each of the different gradations. 

15. A device as claimed in Claim 14, characterised in that, when the device is in the second, backup mode, the second 
set of instructions causes thB device to apply also a different anti-tachyarrhythmia therapy to the heart for each of 
the two different gradations. 

16. A device as claimed in Claim 15, characterised in that at least one gradation of tachyarrhythmia in each of the first 
and second modes corresponds to a fibrillation condition and the first and second sets of instructions each include 
instructions that cause defibrillation therapy to be applied to the heart. 

17. A device as claimed in any of Claims 5 to 16, characterised in that the first memory includes a random access 
memory and the second memory includes a read-only memory. 

18. A device as claimed in Claim 17, characterised in that the controller is caused, in response to a third set of instruc- 
tions stored in the read only memory, to load the second set of instructions from the second memory into the first 
memory, in order to effect a change from the first to the second mode. 
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19. A device as claimed in Claim 18, characterised in that the second memory stores compressed code and the con- 
troller is caused, upon a change to the second, backup mode, to decompress the second set of stored program 
instructions prior to loading it into the first memory. 



5 20. A device as claimed in any of Claims 5 to 1 9, characterised in that the device further comprises a different memory 
address pointer for each of the first and second modes, wherein the memory address pointer for the first mode 
refers the controller to the first memory, and wherein the memory address pointer for the second mode refers the 
controller to the second memory. 



fo 21 . A device as claimed in any of Claims 5 to 20, characterised in that the error detecting mechanism includes at least 
one of: a parity checking element that checks parity of each operating instruction of at least the first set of the 
stored operating instructions; and a checksum operation that performs checksum analysis on operating instructions 
stored in the first memory at least when the controller is operating in the first mode. 

is 22. A device as claimed in Claim 5, characterised in that: the device further comprises a fixed-rate pacing circuit and 
a pulse output circuit; the device has a controller-responsive condition, in which the pulse output circuit responds 
to the output signal of the controller to generate electrical pulses in response thereto, and also a hardware-con- 
trolled pacing condition, in which the pulse output circuit instead responds to the fixed-rate pacing circuit; the pulse 
output circuit is responsive to the error detection mechanism to implement fixed-rate pacing of the heart, inde- 

20 pendent of the controller; and the error detecting mechanism includes a parity checking element that determines 

the existence ot a first parity error by checking parity of at least some data utilized by the controller and determining 
that a second parity error exists, whereupon the device is caused to enter the hardware-controlled pacing condition. 

23. A device as claimed in Claim 22, characterised in that the device operates as a demand pacemaker when it is in 
2S the hardware -controlled pacing condition. 



24. An implantable device that assists the function of a heart by providing a stimulus to the heart, comprising a digital 
circuit having a hierarchy of control levels, the digital circuit having: a controller that determines at least one of 
timing and magnitude of the stimulus in response to each of two alternative sets of stored program instructions, a 

30 first set being associated with a normal mode and a second set being associated with a second, backup mode; 

an error detecting mechanism that detects error; a telemetry circuit that produces a digital signal responsive to 
communication received from outside the body; a watchdog circuit in communication with the controller, requiring 
the controller to acknowledge proper operation; a fixed-rate pacing circuit that is selectively activated by the watch- 
dog circuit; and an output circuit that generates the stimulus supplied to the heart in response to one of the controller 

35 and the watchdog circuit; and in which: a first level of the hierarchy includes telemetry control, wherein the digital 

signal provides the telemetry circuit with the ability to place selectively Ihe controller in at least the first mode, 
wherein the controller functions in reliance upon the first set of stored program instructions; a second level of the 
hierarchy includes watchdog control wherein the watchdog circuit causes the output circuit, when correct acknowl- 
edgement is not received, to generate the stimulus in response to the fixed-rate pacing circuit and not in response 

40 to the controller; and a third level of the hierarchy includes error detecting mechanism control, wherein the error 

detecting mechanism caused the controller to switch from the first mode to the second mode, and thereby rely 
upon the second, alternative set of stored program instructions in response to error detected in the first mode. 
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(54) Implantable cardiac stimulation device 



(57) The present invention provides an implantable 
device that assists the human heart, having automaticity 
functions in each of two different sets of microprocessor 
operating code. Following implantation, telemetry is uti- 
lized to place the device in a first, normal mode of oper- 
ation in which it executes the first set of operating code, 
stored primarily in RAM, and performs parity and check- 
sum software error detection. Upon detection of an er- 



ror, the microprocessor is caused to enter a second, 
backup mode of operation where it executes the second 
set of operating code, which is retained in read-only 
memory. Thus, in the evenl of error deleclion, the im- 
plantable device is still fully functional in its backup 
mode to provide automaticity. The device also includes 
a watchdog circuit, which constantly monitors the micro- 
processor to detect a hardware error, triggering fixed- 
rate pacing if it is detected. 
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